It's a while since i did this, i didn't check the newest baseline from ST, but back then for kirkstone it was really incomplete support for FIP signing (and no yocto support for TF-A signing at all).
I had to build and install it for my host environment (HOSTTOOLS) in order to do the "communication" with the host openssl / pkcs11 instance for the ROT key (which is an USB stick in my case).
Clone it from master (https://github.com/ARM-software/arm-trusted-firmware.git) and then get the baseline for your yocto (e.g. based on the used BSP from ST). I used kirkstone v4 so we used v2.6 and i backported all changes for the cert_create folder of tf-a. (a handfull commits).
in case we are signing via PKCS11 i set the CERTTOOL variable to the external "cert_create", which is installed under a different name in our build system:
CERTTOOL = "${@bb.utils.contains('EXTERNAL_SIGN_PKCS11','1','cert_create_ext', 'cert_create',d)}"
FIP_SIGN_KEY has then to point to the URI like
pkcs11:model=SoftHSM%20v2;manufacturer=SoftHSM%20project;serial=xyz;token=xyz;id=%01;object=tfa-pkey00;type=private
i used the STM32MP_KeyGen_CLI to create the keys (for STM32MP13 eight keys):
STM32MP_KeyGen_CLI -abs <path> -pwd <pwd1> <pwd2>... -n8
(this is relatively good documented)
then import it into your token, e.g with softhsm
softhsm2-util --import privateKey00.pem --label tfa-pkey00 ....
if you need the infos for URI creation i can recommend the p11tool with the option "--list-all". It shows all infos which should be part of the URI.
If i remember correctly you have to import all eight ROT keys (no matter that you use only one selected key for signing) so that the Signing-Tool can use them to create the hashtable for fusing at the end.
